> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truu.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect CrowdStrike

> Create a Falcon API client and connect your CrowdStrike data to TOTAL.

## Prerequisites

* **CrowdStrike Falcon** with **Next-Gen SIEM** or **Falcon LogScale**
* Access to create API clients in the Falcon Console

## Step 1: Determine your CrowdStrike product

TOTAL supports two CrowdStrike products. Each requires a different API scope:

| Product             | How to tell                                                                   | Scopes to enable                                      |
| ------------------- | ----------------------------------------------------------------------------- | ----------------------------------------------------- |
| **Next-Gen SIEM**   | You have detection rules, correlation, and Falcon Fusion SOAR in your console | **NGSIEM** — Read and Write, **App Logs** — Read only |
| **Falcon LogScale** | You use LogScale primarily for log management and search                      | **App Logs** — Read and Write                         |

If you're unsure, check with your CrowdStrike administrator or contact us — we can help identify your product during setup.

## Step 2: Create a Falcon API client

1. Log in to the [Falcon Console](https://falcon.crowdstrike.com)
2. Navigate to **Support and resources > API Clients and Keys**
3. Click **Create API client**
4. Enter a name (e.g. `TOTAL Integration`)
5. In the scope list, enable the scopes from Step 1:
   * For Next-Gen SIEM: enable **NGSIEM** — Read and Write, and **App Logs** — Read only
   * For Falcon LogScale: enable **App Logs** — Read and Write
6. Click **Create**

<Note>
  Write access on NGSIEM or App Logs is required because executing a search is a write operation in CrowdStrike's API. TOTAL only uses this to run CQL queries and read results.

  App Logs Read is needed for NGSIEM customers so TOTAL can discover which repositories and views are available.
</Note>

## Step 3: Copy your credentials

After creating the client, the console displays:

| Value             | Description                                         |
| ----------------- | --------------------------------------------------- |
| **Client ID**     | Your API client identifier                          |
| **Client Secret** | Your API client secret — copy and store it securely |
| **Base URL**      | Identifies your cloud region (see below)            |

<Warning>
  Copy the Client Secret immediately. You may not be able to retrieve it later.
</Warning>

## Step 4: Identify your cloud region

Your Base URL maps to a cloud region:

| Base URL                         | Region   |
| -------------------------------- | -------- |
| `api.crowdstrike.com`            | US-1     |
| `api.us-2.crowdstrike.com`       | US-2     |
| `api.us-3.crowdstrike.com`       | US-3     |
| `api.eu-1.crowdstrike.com`       | EU-1     |
| `api.laggar.gcw.crowdstrike.com` | US-GOV-1 |
| `api.us-gov-2.crowdstrike.mil`   | US-GOV-2 |

Your region also appears in the URL you use to log in to the Falcon Console (e.g. `falcon.us-2.crowdstrike.com` is US-2).

## Step 5: Connect in TOTAL

1. Open **Settings > Connectors** in TOTAL
2. Select **CrowdStrike**
3. Choose your product: **Next-Gen SIEM** or **Falcon LogScale**
4. Enter:
   * **Falcon API Client ID** — from Step 3
   * **Falcon API Client Secret** — from Step 3
   * **Cloud Region** — select the region matching your Base URL from Step 4
5. Click **Connect**

TOTAL stores your credentials securely. Data discovery begins automatically after connection.